New policy for orphaning/retiring packages with open security bugs

[Zbigniew Jędrzejewski-Szmek]

FESCo accepted [1] a new policy to handle packages with long-standing
known security bugs in a way similar to FTBFS bugs:

  AGREED: If a CRITICAL or IMPORTANT security issue is currently open
  against a package, or a security issue of lower severity has been
  open for at least 6 months, four weeks before the branch point a
  procedure similar to long-standing FTBFS will be triggered
  immediately, with 8 weeks of weekly notifications to maintainers and
  subsequent orphaning and then subsequent removal from distribution.
  This applies to all packages, not just leaf.

This policy will apply to F30 and later. The branch point is on
2019/02/19, so somewhere around January 22 the procedure should start
with notifications being sent out. Maintainers are of course encouraged
to fix any security issues immediately. See [2] for a list of currently
open security bugs.

[1] https://pagure.io/fesco/issue/1935#comment-528180
[2]
https://bugzilla.redhat.com/buglist.cgi?bug_status=NEW&bug_status=ASS...

Zbyszek,
on behalf of FESCo
_______________________________________________
devel-announce mailing list -- devel-announce(a)lists.fedoraproject.org
To unsubscribe send an email to devel-announce-leave(a)lists.fedoraproject.org
Fedora Code of Conduct: https://getfedora.org/code-of-conduct.html
List Guidelines: https://fedoraproject.org/wiki/Mailing_list_guidelines
List Archives:
https://lists.fedoraproject.org/archives/list/[e-mail]...

[Christian Stadelmann]

How does one mark a bug as CRITICAL or IMPORTANT?

[Stephen Gallagher]

On Tue, Sep 4, 2018 at 10:00 AM Christian Stadelmann <
genodeftest(a)fedoraproject.org&gt; wrote:

>  How does one mark a bug as CRITICAL or IMPORTANT?
>  

These are CVE classifications and are usually assigned by the security
team.

[Huzaifa Sidhpurwala]

On 09/04/2018 07:29 PM, Christian Stadelmann wrote:
>  How does one mark a bug as CRITICAL or IMPORTANT?
>  _______________________________________________
>  devel mailing list -- devel(a)lists.fedoraproject.org
>  To unsubscribe send an email to devel-leave(a)lists.fedoraproject.org
>  Fedora Code of Conduct: https://getfedora.org/code-of-conduct.html
>  List Guidelines: https://fedoraproject.org/wiki/Mailing_list_guidelines
>  List Archives:
> https://lists.fedoraproject.org/archives/list/[e-mail]
>   
https://access.redhat.com/security/updates/classification contains the
necessary details.

Please let me know if you need more information!


-- 
Huzaifa Sidhpurwala / Red Hat Product Security Team